VarParseNumFromStrcomodo
comodo 时间:2021-01-12 阅读:()
SummaryFileName:putty.
exeFileType:PE32executable(GUI)Intel80386,forMSWindowsSHA1:191abc2025695b1cbe6577c191d55adf3662d0f1MD5:d15600df4207ff41fb1f5a44063917ecMALWAREValkyrieFinalVerdictDETECTIONSECTIONSeverity:HighVerdict:MalwareCLASSIFICATION49%39%29%20%10%Backdoor(5.
71%)Bot(31.
33%)Exploit(0.
00%)Pua(0.
29%)TrojanGeneric(48.
76%)TrojanDownloader(0.
76%)TrojanDropper(1.
71%)Rogue(0.
10%)Virus(0.
00%)RemoteAccessTrojan(0.
00%)Spyware(0.
00%)Rootkit(0.
00%)TrojanPasswordStealer(6.
67%)Worm(4.
67%)Ransomware(0.
00%)HIGHLEVELBEHAVIORDISTRIBUTION47.
0%35.
3%6.
4%Windows(5)Misc(7)System(117)Crypto(1)Process(8)Synchronization(5)Registry(88)FileSystem(16)Device(2)ACTIVITYOVERVIEWPacker1(100.
00%)Page1ActivityDetailsPACKERThebinarylikelycontainsencryptedorcompresseddata.
ShowsourcesPage2BehaviorGraph14:45:2214:45:2214:45:22PID2784Themaliciousfilecreatedachildprocessas191abc2025695b1cbe6577c191d55adf3662d0f1.
exe(PPID2760)14:45:22CreateProcessPage3BehaviorSummaryACCESSEDFILESREADREGISTRYKEYS\Device\KsecDDC:\Users\user\AppData\Local\Temp\191abc2025695b1cbe6577c191d55adf3662d0f1.
exe.
cfgC:\Windows\sysnative\C_932.
NLSC:\Windows\sysnative\C_949.
NLSC:\Windows\sysnative\C_950.
NLSC:\Windows\sysnative\C_936.
NLSC:\Users\user\AppData\Local\Temp\~DF6F7E0B183ED933BA.
TMPC:\Windows\Fonts\staticcache.
datHKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\WindowsErrorReporting\WMR\DisableHKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SESSIONMANAGER\SafeProcessSearchModeHKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\932HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\949HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\950HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\936HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\DataStore_V1.
0\DisableHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\DataStore_V1.
0\DataFilePathHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane1HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane2HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane3HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane4HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane5HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane6HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane7HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane8HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane9HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane10HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane11HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane12HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane13HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane14HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane15Page4RESOLVEDAPISHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane16HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{0000897b-83df-4b96-be07-0fb58b01c4a4}\LanguageProfile\0x00000000\{0001bea3-ed56-483d-a2e2-aeae25577436}\Enablecryptbase.
dll.
SystemFunction036uxtheme.
dll.
ThemeInitApiHookuser32.
dll.
IsProcessDPIAwareoleaut32.
dll.
OleLoadPictureExoleaut32.
dll.
DispCallFuncoleaut32.
dll.
LoadTypeLibExoleaut32.
dll.
UnRegisterTypeLiboleaut32.
dll.
CreateTypeLib2oleaut32.
dll.
VarDateFromUdateoleaut32.
dll.
VarUdateFromDateoleaut32.
dll.
GetAltMonthNamesoleaut32.
dll.
VarNumFromParseNumoleaut32.
dll.
VarParseNumFromStroleaut32.
dll.
VarDecFromR4oleaut32.
dll.
VarDecFromR8oleaut32.
dll.
VarDecFromDateoleaut32.
dll.
VarDecFromI4oleaut32.
dll.
VarDecFromCyoleaut32.
dll.
VarR4FromDecoleaut32.
dll.
GetRecordInfoFromTypeInfooleaut32.
dll.
GetRecordInfoFromGuidsoleaut32.
dll.
SafeArrayGetRecordInfooleaut32.
dll.
SafeArraySetRecordInfooleaut32.
dll.
SafeArrayGetIIDoleaut32.
dll.
SafeArraySetIIDoleaut32.
dll.
SafeArrayCopyDataoleaut32.
dll.
SafeArrayAllocDescriptorExoleaut32.
dll.
SafeArrayCreateExoleaut32.
dll.
VarFormatoleaut32.
dll.
VarFormatDateTimeoleaut32.
dll.
VarFormatNumberPage5oleaut32.
dll.
VarFormatPercentoleaut32.
dll.
VarFormatCurrencyoleaut32.
dll.
VarWeekdayNameoleaut32.
dll.
VarMonthNameoleaut32.
dll.
VarAddoleaut32.
dll.
VarAndoleaut32.
dll.
VarCatoleaut32.
dll.
VarDivoleaut32.
dll.
VarEqvoleaut32.
dll.
VarIdivoleaut32.
dll.
VarImpoleaut32.
dll.
VarModoleaut32.
dll.
VarMuloleaut32.
dll.
VarOroleaut32.
dll.
VarPowoleaut32.
dll.
VarSuboleaut32.
dll.
VarXoroleaut32.
dll.
VarAbsoleaut32.
dll.
VarFixoleaut32.
dll.
VarIntoleaut32.
dll.
VarNegoleaut32.
dll.
VarNotoleaut32.
dll.
VarRoundoleaut32.
dll.
VarCmpoleaut32.
dll.
VarDecAddoleaut32.
dll.
VarDecCmpoleaut32.
dll.
VarBstrCatoleaut32.
dll.
VarCyMulI4oleaut32.
dll.
VarBstrCmpole32.
dll.
CoCreateInstanceExole32.
dll.
CLSIDFromProgIDExsxs.
dll.
SxsOleAut32MapIIDOrCLSIDToTypeLibraryuser32.
dll.
GetSystemMetricsuser32.
dll.
MonitorFromWindowuser32.
dll.
MonitorFromRectPage6REGISTRYKEYSuser32.
dll.
MonitorFromPointuser32.
dll.
EnumDisplayMonitorsuser32.
dll.
GetMonitorInfoAcryptsp.
dll.
CryptAcquireContextWcryptsp.
dll.
CryptGenRandomdwmapi.
dll.
DwmIsCompositionEnabledgdi32.
dll.
GetLayoutgdi32.
dll.
GdiRealizationInfogdi32.
dll.
FontIsLinkedadvapi32.
dll.
RegOpenKeyExWHKEY_LOCAL_MACHINE\Software\Microsoft\Windows\WindowsErrorReporting\WMRHKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\WindowsErrorReporting\WMR\DisableHKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SESSIONMANAGER\SafeProcessSearchModeHKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\CodepageHKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\932HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\949HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\950HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\936HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\VBA\MonitorsHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\FontLink\SystemLinkHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\DataStore_V1.
0HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\DataStore_V1.
0\DisableHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\DataStore_V1.
0\DataFilePathHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallbackHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane1HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane2HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane3HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane4HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane5HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane6HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane7HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane8HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane9Page7READFILESHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane10HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane11HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane12HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane13HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane14HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane15HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane16HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\SegoeUIHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\Compatibility\191abc2025695b1cbe6577c191d55adf3662d0f1.
exeHKEY_LOCAL_MACHINE\Software\Microsoft\CTF\TIP\{0000897b-83df-4b96-be07-0fb58b01c4a4}\LanguageProfile\0x00000000\{0001bea3-ed56-483d-a2e2-aeae25577436}HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{0000897b-83df-4b96-be07-0fb58b01c4a4}\LanguageProfile\0x00000000\{0001bea3-ed56-483d-a2e2-aeae25577436}\Enable\Device\KsecDDC:\Users\user\AppData\Local\Temp\~DF6F7E0B183ED933BA.
TMPC:\Windows\Fonts\staticcache.
datPage8NetworkBehaviorCONTACTEDIPSNETWORKPORTDISTRIBUTION16.
7%50.
0%16.
7%16.
7%3702(UDP)16.
67%5355(UDP)50%138(UDP)16.
67%137(UDP)16.
67%NameIPCountryASNASNNameTriggerProcessTypeUDPPACKETSCallTimeDuringExecution(sec)SourceIPDestIPDestPort7.
1813480854Sandbox224.
0.
0.
25253557.
199187994Sandbox224.
0.
0.
25253557.
20554494858Sandbox239.
255.
255.
25037027.
25436401367Sandbox192.
168.
56.
2551379.
86339116096Sandbox224.
0.
0.
252535513.
3003180027Sandbox192.
168.
56.
255138Page9DETAILEDFILEINFOCREATED/DROPPEDFILESFILEPATHTYPEANDHASHESC:\Users\User\AppData\Local\Temp\~DF6F7E0B183ED933BA.
TMPType:CompositeDocumentFileV2Document,NosummaryinfoMD5:c3d77de3d723019d7706372c03ecd64fSHA-1:26664978545d2c4b9965d9f0e0e83630be5cb60bSHA-256:4e8d510c9910d1b78b9aa71a8edd85a92e0e402a…SHA-512:d92c8593a5f0286b47ba1faa98515433418e9ce55…Size:16.
384Kilobytes.
MATCHYARARULESMATCHRULESSTATICFILEINFOFileName:putty.
exeFileType:PE32executable(GUI)Intel80386,forMSWindowsSHA1:191abc2025695b1cbe6577c191d55adf3662d0f1MD5:d15600df4207ff41fb1f5a44063917ecFirstSeenDate:2018-01-2623:46:18.
635898(aboutayearago)NumberOfClientsSeen:5LastAnalysisDate:2018-01-2623:46:18.
635898(aboutayearago)HumanExpertAnalysisResult:Nohumanexpertanalysisverdictgiventothissampleyet.
Page10DETAILEDFILEINFOADDITIONALFILEINFORMATIONPEHeadersPage11PROPERTYVALUEMagicLiteralEnum3FileTypeEnum6DebugArtifacts[]NumberOfSections3Trid[[84.
4,u'Win32ExecutableMicrosoftVisualBasic6'],[6.
7,u'Win32DynamicLinkLibrary(generic)'],[4.
6,u'Win32Executable(generic)'],[2.
0,u'GenericWin/DOSExecutable'],[2.
0,u'DOSExecutableGeneric']]CompilationTimeStamp0x5A691C22[WedJan2423:52:022018UTC]Translation0x00000x04b0LegalCopyrightFacebookInc.
InternalNameBerdache7FileVersion1.
00CompanyNameTheUPXTeamhttp://upx.
sf.
netLegalTrademarksAVASTSoftwareCommentsIntelProductNameXamasoftProductVersion1.
00FileDescriptionSourcefire,Inc.
OriginalFilenameBerdache7.
exeEntryPoint0x4011bc(.
text)MachineTypeIntel386orlater-32BitFileSize303104Ssdeep3072:zVLrYTTY6ZSwUbp4wy4lI/JcXCNxWH+hp4lRJDOQ+4XmgvbipThWcwv9k0QvA8MU:JoTmwGp4woB7N+uQQyripTVM2Y8McSha2560139454fb4515eb810075d84857d7018cad6abd328df82afdc506f8a59fd2eb2Exifinfo[{u'EXE:FileSubtype':0,u'File:FilePermissions':u'rw-r--r--',u'SourceFile':u'/nfs/fvs/valkyrie_shared/core/valkyrie_files/1/9/1/a/191abc2025695b1cbe6577c191d55adf3662d0f1',u'EXE:OriginalFileName':u'Berdache7.
exe',u'EXE:ProductName':u'Xamasoft',u'EXE:InternalName':u'Berdache7',u'File:MIMEType':u'application/octet-stream',u'File:FileAccessDate':u'2018:01:2623:45:59+00:00',u'EXE:InitializedDataSize':28672,u'File:FileModifyDate':u'2018:01:2623:45:58+00:00',u'EXE:FileVersionNumber':u'1.
0.
0.
0',u'EXE:FileVersion':1.
0,u'File:FileSize':u'296kB',u'EXE:CharacterSet':u'Unicode',u'EXE:MachineType':u'Intel386orlater,andcompatibles',u'EXE:FileOS':u'Win32',u'EXE:LegalTrademarks':u'AVASTSoftware',u'EXE:ProductVersion':1.
0,u'EXE:ObjectFileType':u'Executableapplication',u'File:FileType':u'Win32EXE',u'EXE:CompanyName':u'TheUPXTeamhttp://upx.
sf.
net',u'File:FileName':u'191abc2025695b1cbe6577c191d55adf3662d0f1',u'EXE:ImageVersion':1.
0,u'File:FileTypeExtension':u'exe',u'EXE:OSVersion':4.
0,u'EXE:PEType':u'PE32',u'EXE:TimeStamp':u'2018:01:2423:52:02+00:00',u'EXE:FileFlagsMask':u'0x0000',u'EXE:LegalCopyright':u'FacebookInc.
',u'EXE:LinkerVersion':6.
0,u'EXE:FileFlags':u'(none)',u'EXE:Subsystem':u'WindowsGUI',u'File:Directory':u'/nfs/fvs/valkyrie_shared/core/valkyrie_files/1/9/1/a',u'EXE:FileDescription':u'Sourcefire,Inc.
',u'EXE:EntryPoint':u'0x11bc',u'EXE:SubsystemVersion':4.
0,u'EXE:CodeSize':290816,u'EXE:Comments':u'Intel',u'File:FileInodeChangeDate':u'2018:01:2623:45:59+00:00',u'EXE:UninitializedDataSize':0,u'EXE:LanguageCode':u'Neutral',u'ExifTool:ExifToolVersion':10.
1,u'EXE:ProductVersionNumber':u'1.
0.
0.
0'}]MimeTypeapplication/x-dosexecImphasha9fa280944d9180b2e5bfebfa98e4a15PESectionsPage12NAMEVIRTUALADDRESSVIRTUALSIZERAWSIZEENTROPYMD5.
text0x10000x46df80x470007.
7902237762830a720db1fa39c39fe3baa9d1891d853.
data0x480000x5c1c0x10000.
0620f0b67a91f7f74151bc5be745b7110.
rsrc0x4e0000xe660x10004.
30475677175af539bded62ffaf31f36ca3cc8805c4aPEImportsMSVBVM60.
DLL_CIcos_adj_fptan__vbaFreeVar_adj_fdiv_m64_adj_fprem1None__vbaSetSystemError__vbaHresultCheckObj_adj_fdiv_m32_adj_fdiv_m16i_adj_fdivr_m16i_CIsin__vbaChkstkEVENT_SINK_AddRef__vbaStrCmp__vbaCyI4DllFunctionCall_adj_fpatanEVENT_SINK_Release_CIsqrtEVENT_SINK_QueryInterface__vbaExceptHandler_adj_fprem_adj_fdivr_m64__vbaFPException_CIlog__vbaErrorOverflow__vbaNew2_adj_fdiv_m32i_adj_fdivr_m32i__vbaFreeStrList_adj_fdivr_m32_adj_fdiv_rNone_CIatan__vbaI4Cy_allmul_CItan_CIexpPEResources{u'lang':u'LANG_NEUTRAL',u'name':u'RT_ICON',u'offset':321790,u'sha256':u'99663efee2758204e3cd58f3cbeb62c92b913abdc6656987467e2ea976fbed71',u'type':u'GLS_BINARY_LSB_FIRST',u'size':1384}{u'lang':u'LANG_NEUTRAL',u'name':u'RT_ICON',u'offset':320662,u'sha256':u'a2631dedf7188fbf5640b36941d788d3fdbbb5996244b4891eb6c7313ea2596f',u'type':u'GLS_BINARY_LSB_FIRST',u'size':1128}{u'lang':u'LANG_NEUTRAL',u'name':u'RT_GROUP_ICON',u'offset':320628,u'sha256':u'6369848d3ee42be4460e6f4b9c8b003e2640e7e262220182de7d8f8c64cec290',u'type':u'MSWindowsiconresource-2icons,16x16',u'size':34}{u'lang':u'LANG_NEUTRAL',u'name':u'RT_VERSION',u'offset':319776,u'sha256':u'80ff935a732d6447380ade43d114e62bf37b8cf8f0f192f0dd21bb55a372ed07',u'type':u'data',u'size':852}CERTIFICATEVALIDATION-CertificateValidationisnotApplicablePage13SCREENSHOTSPage14
exeFileType:PE32executable(GUI)Intel80386,forMSWindowsSHA1:191abc2025695b1cbe6577c191d55adf3662d0f1MD5:d15600df4207ff41fb1f5a44063917ecMALWAREValkyrieFinalVerdictDETECTIONSECTIONSeverity:HighVerdict:MalwareCLASSIFICATION49%39%29%20%10%Backdoor(5.
71%)Bot(31.
33%)Exploit(0.
00%)Pua(0.
29%)TrojanGeneric(48.
76%)TrojanDownloader(0.
76%)TrojanDropper(1.
71%)Rogue(0.
10%)Virus(0.
00%)RemoteAccessTrojan(0.
00%)Spyware(0.
00%)Rootkit(0.
00%)TrojanPasswordStealer(6.
67%)Worm(4.
67%)Ransomware(0.
00%)HIGHLEVELBEHAVIORDISTRIBUTION47.
0%35.
3%6.
4%Windows(5)Misc(7)System(117)Crypto(1)Process(8)Synchronization(5)Registry(88)FileSystem(16)Device(2)ACTIVITYOVERVIEWPacker1(100.
00%)Page1ActivityDetailsPACKERThebinarylikelycontainsencryptedorcompresseddata.
ShowsourcesPage2BehaviorGraph14:45:2214:45:2214:45:22PID2784Themaliciousfilecreatedachildprocessas191abc2025695b1cbe6577c191d55adf3662d0f1.
exe(PPID2760)14:45:22CreateProcessPage3BehaviorSummaryACCESSEDFILESREADREGISTRYKEYS\Device\KsecDDC:\Users\user\AppData\Local\Temp\191abc2025695b1cbe6577c191d55adf3662d0f1.
exe.
cfgC:\Windows\sysnative\C_932.
NLSC:\Windows\sysnative\C_949.
NLSC:\Windows\sysnative\C_950.
NLSC:\Windows\sysnative\C_936.
NLSC:\Users\user\AppData\Local\Temp\~DF6F7E0B183ED933BA.
TMPC:\Windows\Fonts\staticcache.
datHKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\WindowsErrorReporting\WMR\DisableHKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SESSIONMANAGER\SafeProcessSearchModeHKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\932HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\949HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\950HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\936HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\DataStore_V1.
0\DisableHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\DataStore_V1.
0\DataFilePathHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane1HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane2HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane3HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane4HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane5HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane6HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane7HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane8HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane9HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane10HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane11HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane12HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane13HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane14HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane15Page4RESOLVEDAPISHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane16HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{0000897b-83df-4b96-be07-0fb58b01c4a4}\LanguageProfile\0x00000000\{0001bea3-ed56-483d-a2e2-aeae25577436}\Enablecryptbase.
dll.
SystemFunction036uxtheme.
dll.
ThemeInitApiHookuser32.
dll.
IsProcessDPIAwareoleaut32.
dll.
OleLoadPictureExoleaut32.
dll.
DispCallFuncoleaut32.
dll.
LoadTypeLibExoleaut32.
dll.
UnRegisterTypeLiboleaut32.
dll.
CreateTypeLib2oleaut32.
dll.
VarDateFromUdateoleaut32.
dll.
VarUdateFromDateoleaut32.
dll.
GetAltMonthNamesoleaut32.
dll.
VarNumFromParseNumoleaut32.
dll.
VarParseNumFromStroleaut32.
dll.
VarDecFromR4oleaut32.
dll.
VarDecFromR8oleaut32.
dll.
VarDecFromDateoleaut32.
dll.
VarDecFromI4oleaut32.
dll.
VarDecFromCyoleaut32.
dll.
VarR4FromDecoleaut32.
dll.
GetRecordInfoFromTypeInfooleaut32.
dll.
GetRecordInfoFromGuidsoleaut32.
dll.
SafeArrayGetRecordInfooleaut32.
dll.
SafeArraySetRecordInfooleaut32.
dll.
SafeArrayGetIIDoleaut32.
dll.
SafeArraySetIIDoleaut32.
dll.
SafeArrayCopyDataoleaut32.
dll.
SafeArrayAllocDescriptorExoleaut32.
dll.
SafeArrayCreateExoleaut32.
dll.
VarFormatoleaut32.
dll.
VarFormatDateTimeoleaut32.
dll.
VarFormatNumberPage5oleaut32.
dll.
VarFormatPercentoleaut32.
dll.
VarFormatCurrencyoleaut32.
dll.
VarWeekdayNameoleaut32.
dll.
VarMonthNameoleaut32.
dll.
VarAddoleaut32.
dll.
VarAndoleaut32.
dll.
VarCatoleaut32.
dll.
VarDivoleaut32.
dll.
VarEqvoleaut32.
dll.
VarIdivoleaut32.
dll.
VarImpoleaut32.
dll.
VarModoleaut32.
dll.
VarMuloleaut32.
dll.
VarOroleaut32.
dll.
VarPowoleaut32.
dll.
VarSuboleaut32.
dll.
VarXoroleaut32.
dll.
VarAbsoleaut32.
dll.
VarFixoleaut32.
dll.
VarIntoleaut32.
dll.
VarNegoleaut32.
dll.
VarNotoleaut32.
dll.
VarRoundoleaut32.
dll.
VarCmpoleaut32.
dll.
VarDecAddoleaut32.
dll.
VarDecCmpoleaut32.
dll.
VarBstrCatoleaut32.
dll.
VarCyMulI4oleaut32.
dll.
VarBstrCmpole32.
dll.
CoCreateInstanceExole32.
dll.
CLSIDFromProgIDExsxs.
dll.
SxsOleAut32MapIIDOrCLSIDToTypeLibraryuser32.
dll.
GetSystemMetricsuser32.
dll.
MonitorFromWindowuser32.
dll.
MonitorFromRectPage6REGISTRYKEYSuser32.
dll.
MonitorFromPointuser32.
dll.
EnumDisplayMonitorsuser32.
dll.
GetMonitorInfoAcryptsp.
dll.
CryptAcquireContextWcryptsp.
dll.
CryptGenRandomdwmapi.
dll.
DwmIsCompositionEnabledgdi32.
dll.
GetLayoutgdi32.
dll.
GdiRealizationInfogdi32.
dll.
FontIsLinkedadvapi32.
dll.
RegOpenKeyExWHKEY_LOCAL_MACHINE\Software\Microsoft\Windows\WindowsErrorReporting\WMRHKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\WindowsErrorReporting\WMR\DisableHKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SESSIONMANAGER\SafeProcessSearchModeHKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\CodepageHKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\932HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\949HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\950HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\936HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\VBA\MonitorsHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\FontLink\SystemLinkHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\DataStore_V1.
0HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\DataStore_V1.
0\DisableHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\DataStore_V1.
0\DataFilePathHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallbackHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane1HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane2HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane3HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane4HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane5HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane6HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane7HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane8HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane9Page7READFILESHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane10HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane11HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane12HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane13HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane14HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane15HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane16HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\SegoeUIHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\Compatibility\191abc2025695b1cbe6577c191d55adf3662d0f1.
exeHKEY_LOCAL_MACHINE\Software\Microsoft\CTF\TIP\{0000897b-83df-4b96-be07-0fb58b01c4a4}\LanguageProfile\0x00000000\{0001bea3-ed56-483d-a2e2-aeae25577436}HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{0000897b-83df-4b96-be07-0fb58b01c4a4}\LanguageProfile\0x00000000\{0001bea3-ed56-483d-a2e2-aeae25577436}\Enable\Device\KsecDDC:\Users\user\AppData\Local\Temp\~DF6F7E0B183ED933BA.
TMPC:\Windows\Fonts\staticcache.
datPage8NetworkBehaviorCONTACTEDIPSNETWORKPORTDISTRIBUTION16.
7%50.
0%16.
7%16.
7%3702(UDP)16.
67%5355(UDP)50%138(UDP)16.
67%137(UDP)16.
67%NameIPCountryASNASNNameTriggerProcessTypeUDPPACKETSCallTimeDuringExecution(sec)SourceIPDestIPDestPort7.
1813480854Sandbox224.
0.
0.
25253557.
199187994Sandbox224.
0.
0.
25253557.
20554494858Sandbox239.
255.
255.
25037027.
25436401367Sandbox192.
168.
56.
2551379.
86339116096Sandbox224.
0.
0.
252535513.
3003180027Sandbox192.
168.
56.
255138Page9DETAILEDFILEINFOCREATED/DROPPEDFILESFILEPATHTYPEANDHASHESC:\Users\User\AppData\Local\Temp\~DF6F7E0B183ED933BA.
TMPType:CompositeDocumentFileV2Document,NosummaryinfoMD5:c3d77de3d723019d7706372c03ecd64fSHA-1:26664978545d2c4b9965d9f0e0e83630be5cb60bSHA-256:4e8d510c9910d1b78b9aa71a8edd85a92e0e402a…SHA-512:d92c8593a5f0286b47ba1faa98515433418e9ce55…Size:16.
384Kilobytes.
MATCHYARARULESMATCHRULESSTATICFILEINFOFileName:putty.
exeFileType:PE32executable(GUI)Intel80386,forMSWindowsSHA1:191abc2025695b1cbe6577c191d55adf3662d0f1MD5:d15600df4207ff41fb1f5a44063917ecFirstSeenDate:2018-01-2623:46:18.
635898(aboutayearago)NumberOfClientsSeen:5LastAnalysisDate:2018-01-2623:46:18.
635898(aboutayearago)HumanExpertAnalysisResult:Nohumanexpertanalysisverdictgiventothissampleyet.
Page10DETAILEDFILEINFOADDITIONALFILEINFORMATIONPEHeadersPage11PROPERTYVALUEMagicLiteralEnum3FileTypeEnum6DebugArtifacts[]NumberOfSections3Trid[[84.
4,u'Win32ExecutableMicrosoftVisualBasic6'],[6.
7,u'Win32DynamicLinkLibrary(generic)'],[4.
6,u'Win32Executable(generic)'],[2.
0,u'GenericWin/DOSExecutable'],[2.
0,u'DOSExecutableGeneric']]CompilationTimeStamp0x5A691C22[WedJan2423:52:022018UTC]Translation0x00000x04b0LegalCopyrightFacebookInc.
InternalNameBerdache7FileVersion1.
00CompanyNameTheUPXTeamhttp://upx.
sf.
netLegalTrademarksAVASTSoftwareCommentsIntelProductNameXamasoftProductVersion1.
00FileDescriptionSourcefire,Inc.
OriginalFilenameBerdache7.
exeEntryPoint0x4011bc(.
text)MachineTypeIntel386orlater-32BitFileSize303104Ssdeep3072:zVLrYTTY6ZSwUbp4wy4lI/JcXCNxWH+hp4lRJDOQ+4XmgvbipThWcwv9k0QvA8MU:JoTmwGp4woB7N+uQQyripTVM2Y8McSha2560139454fb4515eb810075d84857d7018cad6abd328df82afdc506f8a59fd2eb2Exifinfo[{u'EXE:FileSubtype':0,u'File:FilePermissions':u'rw-r--r--',u'SourceFile':u'/nfs/fvs/valkyrie_shared/core/valkyrie_files/1/9/1/a/191abc2025695b1cbe6577c191d55adf3662d0f1',u'EXE:OriginalFileName':u'Berdache7.
exe',u'EXE:ProductName':u'Xamasoft',u'EXE:InternalName':u'Berdache7',u'File:MIMEType':u'application/octet-stream',u'File:FileAccessDate':u'2018:01:2623:45:59+00:00',u'EXE:InitializedDataSize':28672,u'File:FileModifyDate':u'2018:01:2623:45:58+00:00',u'EXE:FileVersionNumber':u'1.
0.
0.
0',u'EXE:FileVersion':1.
0,u'File:FileSize':u'296kB',u'EXE:CharacterSet':u'Unicode',u'EXE:MachineType':u'Intel386orlater,andcompatibles',u'EXE:FileOS':u'Win32',u'EXE:LegalTrademarks':u'AVASTSoftware',u'EXE:ProductVersion':1.
0,u'EXE:ObjectFileType':u'Executableapplication',u'File:FileType':u'Win32EXE',u'EXE:CompanyName':u'TheUPXTeamhttp://upx.
sf.
net',u'File:FileName':u'191abc2025695b1cbe6577c191d55adf3662d0f1',u'EXE:ImageVersion':1.
0,u'File:FileTypeExtension':u'exe',u'EXE:OSVersion':4.
0,u'EXE:PEType':u'PE32',u'EXE:TimeStamp':u'2018:01:2423:52:02+00:00',u'EXE:FileFlagsMask':u'0x0000',u'EXE:LegalCopyright':u'FacebookInc.
',u'EXE:LinkerVersion':6.
0,u'EXE:FileFlags':u'(none)',u'EXE:Subsystem':u'WindowsGUI',u'File:Directory':u'/nfs/fvs/valkyrie_shared/core/valkyrie_files/1/9/1/a',u'EXE:FileDescription':u'Sourcefire,Inc.
',u'EXE:EntryPoint':u'0x11bc',u'EXE:SubsystemVersion':4.
0,u'EXE:CodeSize':290816,u'EXE:Comments':u'Intel',u'File:FileInodeChangeDate':u'2018:01:2623:45:59+00:00',u'EXE:UninitializedDataSize':0,u'EXE:LanguageCode':u'Neutral',u'ExifTool:ExifToolVersion':10.
1,u'EXE:ProductVersionNumber':u'1.
0.
0.
0'}]MimeTypeapplication/x-dosexecImphasha9fa280944d9180b2e5bfebfa98e4a15PESectionsPage12NAMEVIRTUALADDRESSVIRTUALSIZERAWSIZEENTROPYMD5.
text0x10000x46df80x470007.
7902237762830a720db1fa39c39fe3baa9d1891d853.
data0x480000x5c1c0x10000.
0620f0b67a91f7f74151bc5be745b7110.
rsrc0x4e0000xe660x10004.
30475677175af539bded62ffaf31f36ca3cc8805c4aPEImportsMSVBVM60.
DLL_CIcos_adj_fptan__vbaFreeVar_adj_fdiv_m64_adj_fprem1None__vbaSetSystemError__vbaHresultCheckObj_adj_fdiv_m32_adj_fdiv_m16i_adj_fdivr_m16i_CIsin__vbaChkstkEVENT_SINK_AddRef__vbaStrCmp__vbaCyI4DllFunctionCall_adj_fpatanEVENT_SINK_Release_CIsqrtEVENT_SINK_QueryInterface__vbaExceptHandler_adj_fprem_adj_fdivr_m64__vbaFPException_CIlog__vbaErrorOverflow__vbaNew2_adj_fdiv_m32i_adj_fdivr_m32i__vbaFreeStrList_adj_fdivr_m32_adj_fdiv_rNone_CIatan__vbaI4Cy_allmul_CItan_CIexpPEResources{u'lang':u'LANG_NEUTRAL',u'name':u'RT_ICON',u'offset':321790,u'sha256':u'99663efee2758204e3cd58f3cbeb62c92b913abdc6656987467e2ea976fbed71',u'type':u'GLS_BINARY_LSB_FIRST',u'size':1384}{u'lang':u'LANG_NEUTRAL',u'name':u'RT_ICON',u'offset':320662,u'sha256':u'a2631dedf7188fbf5640b36941d788d3fdbbb5996244b4891eb6c7313ea2596f',u'type':u'GLS_BINARY_LSB_FIRST',u'size':1128}{u'lang':u'LANG_NEUTRAL',u'name':u'RT_GROUP_ICON',u'offset':320628,u'sha256':u'6369848d3ee42be4460e6f4b9c8b003e2640e7e262220182de7d8f8c64cec290',u'type':u'MSWindowsiconresource-2icons,16x16',u'size':34}{u'lang':u'LANG_NEUTRAL',u'name':u'RT_VERSION',u'offset':319776,u'sha256':u'80ff935a732d6447380ade43d114e62bf37b8cf8f0f192f0dd21bb55a372ed07',u'type':u'data',u'size':852}CERTIFICATEVALIDATION-CertificateValidationisnotApplicablePage13SCREENSHOTSPage14
- VarParseNumFromStrcomodo相关文档
- cmdmcomodo
- WayBillcomodo
- impactcomodo
- 丂丂丂丂丂丂丂丂丂丂丂丂丂丂丂丂丂丂丂丂丂丂丂丂丂丂丂comodo
- 2011ArubaNetworksInc.
- Europeacomodo
BlueHost 周年庆典 - 美国/香港虚拟主机 美国SSD VPS低至月32元
我们对于BlueHost主机商还是比较熟悉的，早年我们还是全民使用虚拟主机的时候，大部分的外贸主机都会用到BlueHost无限虚拟主机方案，那时候他们商家只有一款虚拟主机方案。目前，商家国际款和国内款是有差异营销的，BlueHost国内有提供香港、美国、印度和欧洲机房。包括有提供虚拟主机、VPS和独立服务器。现在，BlueHost 商家周年活动，全场五折优惠。我们看看这次的活动有哪些值得选择的。 ...
justhost：“第4次VPS测评”，8.3元/月，200M带宽，不限流量，KVM虚拟，4个俄罗斯机房应有适合你的
justhost.ru官方来消息说已经对网络进行了比较全面的优化，针对中国电信、联通、移动来说，4个机房总有一个适合中国用户，让站长进行一下测试，这不就有了这篇有关justhost的VPS的第四次测评。本帖主要关注的是网络，对于其他的参数一概不管！ 官方网站：https://justhost.ru 最低配VPS：8.3元/月，KVM，512M内存，5G硬盘，200M带宽，不限流量 购买链接：...
FlashFXP FTP工具无法连接主机常见原因及解决办法
目前，我们都在用哪个FTP软件？喜欢用的是WinSCP，是一款免费的FTP/SFTP软件。今天在帮助一个网友远程解决问题的时候看到他用的是FlashFXP FTP工具，这个工具以前我也用过，不过正版是需要付费的，但是网上有很多的绿色版本和破解版本。考虑到安全的问题，个人不建议选择破解版。但是这款软件还是比较好用的。今天主要是遇到他的虚拟主机无法通过FTP连接主机，这里我就帮忙看看到底是什么问题。一...
comodo为你推荐
-
美国主机租用国外服务器提供商有哪几家比较好的。。。me域名注册什么是ME域名，为什么注册ME域名海外服务器租用外国服务器怎么租用？空间域名服务器和空间域名什么意思台湾vps台湾服务器 哪里稳定速度快？网站空间购买企业网站空间购买的网站空间具体需要多大的合适？什么是虚拟主机虚拟主机是什么成都虚拟主机成都唯度科技有限公司怎么样？asp虚拟主机支持ASP MSSQL 的虚拟主机有哪些推荐广西虚拟主机江西服务器托管，但要接入专线，问了很多代理都说不可以，如何解决？